Cleanups and fixes

Author: alextwoods

core/auth/src/main/java/software/amazon/awssdk/auth/credentials/AwsCredentialsProviderChain.java

@@ -132,13 +132,11 @@ public AwsCredentials resolveCredentials() {
     }
 
     @Override
-    @SuppressWarnings("unchecked")
     public CompletableFuture<Void> invalidate(AwsCredentialsIdentity identity) {
         CompletableFuture<?>[] futures = credentialsProviders.stream()
             .map(provider -> {
                 try {
-                    return ((IdentityProvider<AwsCredentialsIdentity>) provider)
-                        .invalidate(identity)
+                    return invalidateProvider(provider, identity)
                         .exceptionally(e -> {
                             log.debug(() -> "Failed to invalidate provider " + provider + ": " + e.getMessage(), e);
                             return null;
@@ -152,6 +150,17 @@ public CompletableFuture<Void> invalidate(AwsCredentialsIdentity identity) {
         return CompletableFuture.allOf(futures);
     }
 
+    /**
+     * Helper to call invalidate with proper type capture, avoiding unchecked casts.
+     * The identity is always an AwsCredentialsIdentity, and all providers in this chain
+     * are IdentityProvider&lt;? extends AwsCredentialsIdentity&gt;, so the cast is safe.
+     */
+    @SuppressWarnings("unchecked")
+    private static <T extends AwsCredentialsIdentity> CompletableFuture<Void> invalidateProvider(
+            IdentityProvider<T> provider, AwsCredentialsIdentity identity) {
+        return provider.invalidate((T) identity);
+    }
+
     @Override
     public void close() {
         credentialsProviders.forEach(c -> IoUtils.closeIfCloseable(c, null));

core/auth/src/main/java/software/amazon/awssdk/auth/credentials/ContainerCredentialsProvider.java

@@ -38,7 +38,6 @@
 import java.util.function.Predicate;
 import software.amazon.awssdk.annotations.SdkPublicApi;
 import software.amazon.awssdk.auth.credentials.internal.ContainerCredentialsRetryPolicy;
-import software.amazon.awssdk.auth.credentials.internal.CredentialsInvalidationUtils;
 import software.amazon.awssdk.auth.credentials.internal.HttpCredentialsLoader;
 import software.amazon.awssdk.auth.credentials.internal.HttpCredentialsLoader.LoadedCredentials;
 import software.amazon.awssdk.core.SdkSystemSetting;
@@ -191,8 +190,10 @@ public AwsCredentials resolveCredentials() {
 
     @Override
     public CompletableFuture<Void> invalidate(AwsCredentialsIdentity identity) {
-        return CredentialsInvalidationUtils.invalidateCredentialsCache(
-            identity, credentialsCache, AwsCredentialsIdentity::accessKeyId);
+        String rejectedAccessKeyId = identity.accessKeyId();
+        return CompletableFuture.runAsync(() ->
+            credentialsCache.invalidate(cachedCreds -> rejectedAccessKeyId.equals(cachedCreds.accessKeyId()))
+        );
     }
 
     @Override

core/auth/src/main/java/software/amazon/awssdk/auth/credentials/InstanceProfileCredentialsProvider.java

@@ -30,7 +30,6 @@
 import java.util.function.Supplier;
 import software.amazon.awssdk.annotations.SdkPublicApi;
 import software.amazon.awssdk.annotations.SdkTestInternalApi;
-import software.amazon.awssdk.auth.credentials.internal.CredentialsInvalidationUtils;
 import software.amazon.awssdk.auth.credentials.internal.Ec2MetadataConfigProvider;
 import software.amazon.awssdk.auth.credentials.internal.HttpCredentialsLoader;
 import software.amazon.awssdk.auth.credentials.internal.HttpCredentialsLoader.LoadedCredentials;
@@ -172,8 +171,10 @@ public AwsCredentials resolveCredentials() {
 
     @Override
     public CompletableFuture<Void> invalidate(AwsCredentialsIdentity identity) {
-        return CredentialsInvalidationUtils.invalidateCredentialsCache(
-            identity, credentialsCache, AwsCredentialsIdentity::accessKeyId);
+        String rejectedAccessKeyId = identity.accessKeyId();
+        return CompletableFuture.runAsync(() ->
+            credentialsCache.invalidate(cachedCreds -> rejectedAccessKeyId.equals(cachedCreds.accessKeyId()))
+        );
     }
 
     private RefreshResult<AwsCredentials> refreshCredentials() {

core/auth/src/main/java/software/amazon/awssdk/auth/credentials/ProcessCredentialsProvider.java

@@ -27,7 +27,6 @@
 import java.util.Optional;
 import java.util.concurrent.CompletableFuture;
 import software.amazon.awssdk.annotations.SdkPublicApi;
-import software.amazon.awssdk.auth.credentials.internal.CredentialsInvalidationUtils;
 import software.amazon.awssdk.core.useragent.BusinessMetricFeatureId;
 import software.amazon.awssdk.identity.spi.AwsCredentialsIdentity;
 import software.amazon.awssdk.protocols.jsoncore.JsonNode;
@@ -171,8 +170,10 @@ public AwsCredentials resolveCredentials() {
 
     @Override
     public CompletableFuture<Void> invalidate(AwsCredentialsIdentity identity) {
-        return CredentialsInvalidationUtils.invalidateCredentialsCache(
-            identity, processCredentialCache, AwsCredentialsIdentity::accessKeyId);
+        String rejectedAccessKeyId = identity.accessKeyId();
+        return CompletableFuture.runAsync(() ->
+            processCredentialCache.invalidate(cachedCreds -> rejectedAccessKeyId.equals(cachedCreds.accessKeyId()))
+        );
     }
 
     private RefreshResult<AwsCredentials> refreshCredentials() {

core/auth/src/main/java/software/amazon/awssdk/auth/credentials/internal/CredentialsInvalidationUtils.java

@@ -18,8 +18,14 @@
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
 
 import java.util.Arrays;
+import java.util.concurrent.CompletableFuture;
 import org.junit.Test;
 import org.junit.jupiter.api.function.Executable;
 import software.amazon.awssdk.core.exception.SdkClientException;
@@ -172,6 +178,65 @@ private static void assertChainResolvesCorrectly(AwsCredentialsProviderChain cha
         assertThat(credentials.secretAccessKey()).isEqualTo("secretKey");
     }
 
+    @Test
+    public void invalidate_propagatesToAllChildren() {
+        TrackingCredentialsProvider provider1 = new TrackingCredentialsProvider("key1", "secret1");
+        TrackingCredentialsProvider provider2 = new TrackingCredentialsProvider("key2", "secret2");
+        TrackingCredentialsProvider provider3 = new TrackingCredentialsProvider("key3", "secret3");
+
+        AwsCredentialsProviderChain chain = AwsCredentialsProviderChain.builder()
+                                                                       .credentialsProviders(provider1, provider2, provider3)
+                                                                       .build();
+
+        AwsCredentialsIdentity identity = AwsBasicCredentials.create("key1", "secret1");
+        chain.invalidate(identity).join();
+
+        assertThat(provider1.invalidateCallCount).isEqualTo(1);
+        assertThat(provider2.invalidateCallCount).isEqualTo(1);
+        assertThat(provider3.invalidateCallCount).isEqualTo(1);
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void invalidate_doesNotShortCircuit_whenChildThrows() {
+        AwsCredentialsProvider mockProvider1 = mock(AwsCredentialsProvider.class);
+        AwsCredentialsProvider mockProvider2 = mock(AwsCredentialsProvider.class);
+        AwsCredentialsProvider mockProvider3 = mock(AwsCredentialsProvider.class);
+
+        doThrow(new RuntimeException("Provider 1 failed")).when(mockProvider1).invalidate(any());
+
+        AwsCredentialsProviderChain chain = AwsCredentialsProviderChain.builder()
+                                                                       .credentialsProviders(mockProvider1, mockProvider2, mockProvider3)
+                                                                       .build();
+
+        AwsCredentialsIdentity identity = AwsBasicCredentials.create("key1", "secret1");
+        chain.invalidate(identity).join();
+
+        verify(mockProvider1, times(1)).invalidate(identity);
+        verify(mockProvider2, times(1)).invalidate(identity);
+        verify(mockProvider3, times(1)).invalidate(identity);
+    }
+
+    private static final class TrackingCredentialsProvider implements AwsCredentialsProvider {
+        private final AwsBasicCredentials credentials;
+        int invalidateCallCount = 0;
+
+        TrackingCredentialsProvider(String accessKeyId, String secretAccessKey) {
+            this.credentials = AwsBasicCredentials.create(accessKeyId, secretAccessKey);
+        }
+
+        @Override
+        public AwsCredentials resolveCredentials() {
+            return credentials;
+        }
+
+        @Override
+        public CompletableFuture<Void> invalidate(AwsCredentialsIdentity identity) {
+            invalidateCallCount++;
+            return CompletableFuture.completedFuture(null);
+        }
+    }
+
     private static final class MockCredentialsProvider implements AwsCredentialsProvider {
         private final StaticCredentialsProvider staticCredentialsProvider;
         private final String exceptionMessage;